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U.S. Department of Homeland Security (DHS) is working to enhance the security of 
facilities storing chemicals that could either be stolen or used by terrorists to inflict mass 
casualties and destroy critical assets. DHS has identified security issues at these facilities, 
including the potential for chemical release; theft or diversion; and sabotage or contamination. 
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Under the Department of Homeland Security Appropriations 
Act of 2007, DHS has the authority and funding to regulate 
security at facilities storing chemicals considered to be high-risk 
(P. L. 109-295, Section 550). The Department of Homeland 
Security Chemical Facility Anti-Terrorism Standards (CFATS) Final 
Rule (6 CFR Part 27) was published in the Federal Register Aprfi^, 
2007. This Rule uses 19 Risk-Based Performance Standards (RBPS) 
designed to improve the security of facilities storing chemicals. 

DHS expects most submissions to come from chemical 
manufacturing, storage and distribution facilities, petroleum 
refineries, and liquefied natural gas storage (peak shaving) facilities. 
These facilities can store one or more of the “chemicals of 
interest” at the threshold quantity identified in Appendix A of the 
Rule. Depending on the types andjcfuantities of chemicals stored 
at research and laboratory facilities, universities and colleges may 
be responsible for responding to these new standards. 

Fast-P aced compliance schedule to comPle te toP screen 

On November 20, 2007, Appendix A: Chemicals of Interest 
(COI) was published in the Federal Register, identifying the 


specific chemicals and storage thresholds for these chemicals. 
The addition of Appendix A to the Rule triggered a fast-paced 
compliance schedule. 

The initiating event is fairly straightforward. If a facility 
stores any of the chemicals listed in Appendix A at the storage 
thresholds given, the facility will have 60 days to register each 
facility and complete the on-line Chemical Survey Assessment 
Tool (CSAT), or Top Screen. Top Screen asks for detailed 
information on the quantity, storage method, and location of any 
COI that exceeds the given threshold. Universities and colleges 
may request a 60-day extension with no further explanation. 

The process of matching a facility’s inventory to the COI 
seems simple, but it ignores the challenges seen by organizations 
that aren’t traditionally classified as large chemical handlers, 
such as universities, colleges, hospitals, and other medical 
research facilities. Due to the nature of the operations and 
funding of these institutions, chemical purchasing is often 
conducted by researchers, rather than through a central office. 
Thus, these institutions don’t always know which chemicals they 
have on property. 
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Who is r esPonsibl e Fore omPI ia nee act ivit ies? 

The Department of Homeland Security’s Chemical Security 
Task Force is reaching out to the top 5 0 large chemical handlers 
to assist them in complying with CFATS. But DHS originally 
estimated 40,000 facilities will need to submit a Top Screen and 
approximately 6,000 of those will be classified as high-risk. 

Another concern is that many facilities that should comply 
with CFATS may not even know that the rule exists. Thanks to 
professional organizations focusing on environmental health and 
safety (EHS) and large chemical handling companies, word is 
gradually reaching the intended targets. And, while security is the 
primary driver of the rule, EHS professionals seem to be tasked 
with leading compliance activities. 

Whether compliance is assigned to EHS, security, emergency 
services, or facility operations, the ultimate responsibility lies 
with a designated officer at the institution, who must signoff on 
the CSAT/Top Screen submission, verifying its content. For 
colleges and universities, this may be the president, provost, 
dean, or another senior official. 

Get t inG inFo toe omPI etethetoP screen—t he basics 

DHS has assigned chemicals to a category (or in some cases 
multiple categories) of security vulnerability, based on their 

potential use: Release, Theft, and/or Sabotage. While 
cumbersome to review in concert with Appendix A COI, these 

categories are important to identify because of their associated 
security vulnerabilities. 

When determining if you have a COI at the threshold 
identified in Appendix A , remember that the calculation is 
cumulative, so if a chemical has a 500 lb. threshold and you have 
three buildings storing 200 lbs. each, the aggregate total is 600 
lbs., and must be reported. Also, if the identified chemical makes 
up over 1 percent of the constituents of a mixture, you must 
include the sum total in your analysis. 

Colleges and universities are exempt from including chemicals 
used in laboratories which fall under the category of Release; 
however some of those are also categorized as Theft or Sabotage 
chemicals, in which case they must be reported. Information 
about the Rule relevant to colleges and universities is available 
on the Campus Safety, Health and Environmental Management 
Association (CSHEMA) website at www.cshema. org. CSHEMA 
and the National Association of College and University Business 
Officers (NACUBO) have been closely following the rule and 
have posted guidance on everything from how to request a 60- 
day extension, to a list of the most common chemicals found on 
campuses on the CSHEMA site. 

Respondents need to gather not only the types and quantities 
of chemicals, but also the types of storage containers used. 

Can one person pick the container up and carry it away? Is it 
in a tank on wheels that could be hitched to a vehicle? Is it in a 
permanent storage tank that could be sabotaged, used to ignite 
an explosion, or tampered with for deliberate release? Also, DHS 


needs not only the street address, but the GPS coordinates for 
each identified chemical. In addition, DHS’s analysis of your Top 
Screen submission, and subsequent classification under CFATS 
as either a high-risk/regulated facility or a low-risk/not-regulated 
facility, includes an examination of the surrounding community 
and neighboring businesses. 

ident iFyinG secur ity vul ner a bil it y a n d PI a n n in G 
Fors ite secur ity 

Once a facility submits its Top Screen, DHS will analyze 
the results and determine whether or not the facility will be 
categorized as high-risk. Each facility will be electronically notified 
of the results, and facilities deemed high-risk will be assigned a 
Tier (1 to 4, with 1 being the highest risk). The owner/operator of 
facilities deemed high-risk will be provided with a list identifying 
which of the 19 Risk-Based Performance Standards (RBPS) 
they will need to address in a Security Vulnerability Assessment 
(SVA) of their site, due 90 days after notification, a look at 
the 19 risk-based PerFormance standards (rbPs) When DHS 
categorizes a facility as high-risk, they use the following 19 RBPS 
to communicate measures required to secure chemicals. It is up to 
the facility to interpret these and determine the best methods for 
implementation of and response to the identified RBPS: 


Restrict Area Perimeter 

11. Training 

Secure Site Assets 

12. Personnel Surety 

Screen and Control 

13. Elevated Threats 

Access 

14. Specific Threats 

Deter, Detect, Delay 

15. Reporting Significant 

Shipping, Receipt and 

Security Incidents 

Storage 

16. Incidents and Suspicious 

Theft and Diversions 

Activities 

Sabotage 

17. Officials and Organization 

Cyber 

18. Records 

Response 

19. Any RBPS specified 

Monitoring 

by DHS 


While requirements will vary at each specific site, it is likely 
that training and records will be on most lists. 

sitesecurityPlans(ssP) 

The final step for each facility will be to design and 
implement a Site Security Plan (SSP), closing any security 
gaps identified in the SVA and taking into consideration 
the applicable RBPS. All facilities with multiple buildings, 
including colleges and universities, are given flexibility to 
define their boundaries as either the entire property or the 
individual building where the COI is stored. 

The Rule expects facilities to develop a layered approach 
to security measures, with a written plan which describes each 
component and how it—in combination with other security 
measures—will address the identified RBPS. The owner/ 
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THE RULE EXPECTS FACILITIES TO 
DEVELOP A LAYERED APPROACH 
TO SECURITY MEASURES, WITH A 
WRITTEN PLAN WHICH DESCRIBES 
EACH COMPONENT AND HOW 
IT—IN COMBINATION WITH OTHER 
SECURITY MEASURES-WILL 
ADDRESS THE IDENTIFIED RBPS. 


many useful tools, such as a PDF file of the Top Screen 
questions and a Top Screen users manual, dozens of FAQ’s, 
CVI training, and contact information for the CSAT help 
desk. Institutions need to begin this process now in order to 
address the important issues of creating a database of current 
chemicals, identifying funding for security improvements, and 
maintaining confidentiality while developing site security plans 
in coordination with local public agencies, (j) 

Nancy Mathews is a certified emergency manager and 
serves as senior disaster response manager for Haley & 

Aldrich, Inc., Manchester, NH. E-mail her at nmathews@ 
haleyaldrich.com. This is her first article for Facilities Manager. 


operator of the facility will also be required to maintain and 
update the SSP on a regular basis. Facilities covered by the 
Rule have flexibility in determining the methods they will 
use to meet the requirements. DHS will assess the adequacy 
of those security measures by reviewing the written SSP and 
conducting site visits. 

ProtectinGchemical -terrorismvul nerabil ity 
inFor mation (cvi) 

Of course, businesses and institutions _ 

are concerned with keeping detailed 
chemical inventories and security 
vulnerability data private. Many states 
have “Right to Know” or “Sunshine” 
laws which require a facility to disclose 
to the public which chemicals are on 
site. Emergency response plans shared 
with local law enforcement and fire 
departments may also be available as 
public documents. 

This Rule treats all such information, 
once submitted to DHS through the 
Top Screen, as Chemical-Terrorism 
Vulnerability Information (CVI). This 
information remains secure under the 
CVI designation, and is not subject to any 
“Right to Know” laws. In fact, DHS takes 
protecting CVI so seriously that anyone 
with access to the CVI must complete CVI 
training to ensure they understand the 
responsibility to protect what they know. 

While there are significant penalties 
for non-compliance (up to $25,000/day), 
the intent of this regulation is to improve 
chemical security, not collect fines. DHS 
is doing its best to assist institutions 
with the CFATS process. Their website 
(www.dhs.gov/chemicalsecurity) includes 




Coming Soon 

Environmental Compliance Assistance Guide for 
Colleges and Universities, second edition 

Published by APPA and CSHEMA. Available at 
www.appa.org/bookstore 



Get A Grip... 

on your facility, with ManageWize™ 
Cleaning Management Software.™ 

With over 15 years of use in the industry 
and a remarkable ROI, MOMS is recognized 
as best-in-breed software by experienced 
facility managers everywhere. 

Not only do we offer great software, we support 
our product with on-site training, expert startup 
support services and a network of experienced 
consultants to help you get a grip on your facility. 

Call 1-877-551-9523 for an on-line demonstration 
or download a free evaluation copy today. 
www.managewize.com 


INFORMED LLC 

Smart software for smart people ® 

60 Kensico Rd. STE 26,Thornwood, NY 10594 
email: info@managewize.net 
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